CICADA 3301 2014 PUZZLE FACTS PART 6
A new message After a long period of inactivity, at around 00:00 29/01/2014 UTC, Onion 4 came online again (after being offline for a period of time). The content of the page was hex encoded output, similar to the rest of the data we've received from previous onions. A mirror of the content can be found here. Analysis of new Onion 4 data Onion 4 contained 4 different JPGs: https://infotomb.com/qjiqh https://infotomb.com/3vw2u https://infotomb.com/609xy https://infotomb.com/8do0b Rune Decoding Runes were not in plain english. Decoding them only using Gematria Primus didnt yield readable result. It was found that it was encrypted with substitution cipher. It was first solved by and Here is the key for substitution: http://pastebin.com/dBdX26x4 Key is: 15:14 NiceLurk: seriously, look, that's the gematria starting from T and taken in reverse order i will make table in PS later and post it here Transcription of runes by sibilance Onion 4 Transcription of runes by sibilance...essen... Page 1: A Koan: A man decided to go and study with a maste r. He went to the door of the master. "Who are yo u who wishes to study her e" asked the master. The stude nt told the master his name. "That is not what you are, tha t is only what you are cal led. Who are you who wish es to study here" he aske Page 2: d again. The man thought for a moment and replied "I am a professor". "That is what you do, not what you are." replied the master. "Who ar e you who wishes to stud y here". Confused the man th ought some more. Finally, he answered, "I am a human b eing". "That is only your spe cies, not who you are. wh Page 3: o are you who wishes to study here", asked the maste r again. after a moment of th ought the professor repl ied "I am a consciousness i nhabiting an arbitrary body ". "That is merely what you a re not who you are. Who a re you who wishes to stu dy here". The man was getting ir ritated. "I am," he started, Page 4: but he could not think of anything else to say, so he tra iled off. After a long pause the master replied, "Then yo u are welcome to come stu dy" An Instruction: Do four unreasonable things each da y: A Koan A man decided to go and study with a master. He went to the door of the master "who are you who wishes to study here?" asked the master. The student told the master his name. "That is not what you are that is only what you are called. Who are you who wishes to study here?" he asked again. The man thought for a moment, and replied "I am a professor." "That is what you do, not what you are" replied the master. "Who are you who wishes to study here?" Confused, the man thought some more. Finally, he answered, "I am a human being." "That is only your species, not who you are. Who are you who wishes to study here?" asked the master again. After a moment of thought, the professor replied "I am a consciousness inhabiting an arbitrary body." "That is merely what you are not who you are" who are you who wishes to study here?" The man was getting irritated. "I am," he started, but he could not think of anything else to say, so he trailed off. After a long pause the master replied "then you are welcome to come study." An Instruction Do four unreasonable things each day. New pages for Liber Primus book from onion 4 Onion-3.jpg Onion-2.jpg Onion-1.jpg Onion-0.jpg Outguess and a Transposition Cipher While outguess did return data for all images, only the 3rd of them seemed to be readable. The message was: For those who have fallen behind: TL BE IE OV UT HT RE ID TS EO ST PO SO YR SL BT II IY T4 DG UQ IM NU 44 2I 15 33 9M Good luck. 3301 It was quickly figured out that this was a message encoded with a transposition cypher. When arranged in a rectangle with 7 columns for each letter, then decoding using the key 1736254 (where each number is the character position), we see the message as: TOBELIEVETRUTHISTODESTROYPOSSIBILITYQ4TGUDI2N4M4UIM59133 Or, written in a more readable form : To believe truth is to destroy possibility - http://q4tgudi2n4m4uim5 - 9133 Tool that was used: http://tholman.com/other/transposition/ Unanswered questions * Why was 9133 at the end of the URL to onion 5? * 9133 is prime number (as is 3319) * We assumed it was a port number, but it didn't work A new Onion (Onion 5) The new onion contained a *LARGE* amount of hex data -- enough to crash Firefox as it were. The data can be found here. Not only that, but the message was signed and confirmed to be the same legitimate Cicada key (which verified that we can "trust" it). 'Hex string on onion 5' Once again, analysis revealed this to be a .mp3 file, in the same style of last year's mp3 file, but this year's is called Interconnectedness. Hex posted on onion was not plain mp3 file. It was actually gzip file that needed to be decompressed to get mp3. Gzip files begin with 0x1F (ID1) 0x8B (ID2). blob.bin: gzip compressed data, was "data.out", from Unix, last modified: Fri Jan 24 21:10:12 I dont have any more details about gzip file atm (timestamp of creation, comments, version...) 'More details about html and hex string:' Here is beginning nad ending of hex string on onion (2014.01.29 01:25 http://avowyfgl5lkzfj3n.onion) 1f8b0808a4c8e2520003646174612e6f757400ecfd65545c5db72e8a169a e0c12d40d020c1dd09c1ddb580e0eeee24b8bb6b702778e1047702145eb8 17ee0e87f75bfbb67bdadef7b6b3cf9ff3add5ce7a5a9b3565688d31677f ... . ... f684b4849898c8417188c84121b0a0c0819d7c7c3b7709eddcc1c3cbcbcd cdcdc3c9c5cdc5c5036c9d84d559d68bd56340cf40eff21ee007f31bf3bf 001633b8008ff02d00 For more details look in logs below this post: 01:14 do you know that onion 4 is back up? Here are few (again contadictory) posts of people who saw string on onion 4 and 5 on Jan 29th. If you solve any contradictions (actual html tags, that additionl string someone mentioned, why gzip apeared corupt for some...) please note that in wikia below. 08:53 onion 5 had this html 08:53 08:53 -----BEGIN PGP SIGNED MESSAGE----- 08:53 Hash: SHA1 01:29 no additional html just the text (?!?!? did page had htm tags ot plaintext?) 01:20 http://tinypic.com/r/16ih9n8/8 01:20 in addition to the large blob there is this in the end: 001633b8008ff02d00 01:31 I mean the clearnet proxy might add the additional html 01:31 anyway, the hex string is the same blob.bin: gzip compressed data, was "data.out", from Unix, last modified: Fri Jan 24 21:10:12 2014 sibilance: it appears to be gzip but fails to decompress 01:27 here, got it up on infotomb: https://infotomb.com/ujvmg 01:27 https://infotomb.com/uhsc3 01:33 https://infotomb.com/gxvhz includes my screenshot 01:33 it uncompressed fine for me 'Problem 1 solved, there were NO html tags'! 16:29 last nights onions DIDN'T have any html.. just raw data.. if u saw html it was added by your browser/firebug/whatevertooluuse16:15 should see the raw html download as the .html file i posted 16:16 from last night 16:17 q4utgdi2n4m4uim5.onion.html 16:17 should have the raw download 16:32 NiceLurk indeed i got it by saving output in firefox - so maybe auto-generated? 16:33 akame: yeah must be something like this, when you save as html it adds html tags, you have to right click and wiev page source to get original page content 'Problem 2 saw additinal line '001633b8008ff02d00 'Mp3 ID3 tags:' artist: 3301 song: Interconnectedness title: Interconnectedness The word "Interconnectedness" has a Gematria value of 772, and the song is 277.133 seconds long. Analysis of the song Analysis of the song is currently ongoing. 16:26 https://infotomb.com/614ww <-- midi from the notes in the mp3 file More detailed analysis of Interconnectedness mp3 Titanpads from time of solving onion 4 string and onion 5 string: http://titanpad.com/bQwpt7NDUP http://titanpad.com/2IDiePVoFH <--conatains also of factual data Maybe cipher in mp3 is similar than one in 2012 midid puzzle was After the RSA puzzle, people who submitted the correct answer to their individual RSA puzzle (each person had different "n") to the onion page received another email with a MIDI puzzle. The MIDI puzzle and solution can be found there: http://pastebin.com/4nrDxVXk. If you don't understand how the cipher was solved ask in #33012013 or #cicadasolvers. BAsicly it was substitution cipher where one tone in midi was one letter. Midi consist two songs. Second one is encrypted text from Chorus of Blakes Poem A Song of Liberty (Let the Chorus be your guide to the depths : was hint). First midi song was encrypted text players had to decrpy, with unique set of words on the end: verygood you have proven to be most dedicated to come this far to attain enlightenment create a gpg key for your email address and upload it to the mit key servers then encrypt the the following word list using the cicada three three ero one public key sign it with your key send the ascii armoured ciphertet to the gmail address from which you received your numbers your words are list of words here garden ball house cat shore back head galon Lurkers midi puzzle from 2012 example: 18:40 https://infotomb.com/oq17i here is midi from 2012 18:40 http://pastebin.com/4nrDxVXk here is how it was solved ---- ---- ---- ---- ↑ ↑ ↑The happening (FACTUAL PART OF WIKIA 2014 PAGE 6) above this line ↑ ↑ ↑ ↓ ↓ ↓ ↓ The happening (BRAINSTORMING and OPEN LEADS) bellow this line ↓ ↓ ↓ ↓ ---- ---- ---- ---- spectorgram 13:33 guys does the structure of mp3 forces patterns in data? 13:34 since after loading mp3 as 'data' into gimp and with some width/height playing around you can get white lines http://i.imgur.com/eXNLU1h.jpg i'm not sure if spek doesn't lie there since audacity doesn't recognize anything above 20 khz, and spek claims something is higher than that 10:55 http://i.imgur.com/8q9Xxaw.jpg 10:56 in the middle at about 2:20 10:56 see? Eve57 XORING 13:36 Final result of XOR started last night; images and MP3: http://pastebin.com/7j73TupH OutGuess noise: http://pastebin.com/fe1GqNMT 13:37 Nothing, btw. ^^ 14:18 Yes I did all possible combinations. 14:18 I found some good tool to XOR instantly file to file. 14:18 36 XOR outputs in total. 14:18 15 of them final. 14:18 and you got legit ID3 tag file beginnings? 14:18 Yes. 14:19 At all finals. 14:19 also link the tool and put it on tolls page so otehr can try it also 16:44 I gave it, sec. 16:44 http://www.nirsoft.net/utils/xorfiles.html 16:44 ^ XorFiles v1.0 ^ 16:45 Works like a charm with wine. Mp3 stego tools 05:39 guys there's a stego tool for mp3: http://www.petitcolas.net/fabien/steganography/mp3stego/ 16:49 There's another stego tool for MP3s 16:49 OpenPuff 16:50 http://embeddedsw.net/OpenPuff_Steganography_Home.html Some XORING with no results 20:05 No useable file headers (for images/text/compressed data/mp3) found in onion4.image00.jpg (823807 bytes) XORed with any of the 256 byte strings or their byte-order reverse copies at all possible offsets Some more XORING with interesting result but not sure if anything (((JPG#1XOROnion5MP3)XORJPG#2)XORJPG#4)XOROnion5MP3. http://speedy.sh/yYXj5/4xorsTotal = Jokes That Were On This Page = Have been moved here: CICADA_3301_2014_PUZZLE_FACTS_THE_END_JOKES